diff options
| author | Paul Mackerras <paulus@samba.org> | 2008-01-31 11:25:51 +1100 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2008-01-31 11:25:51 +1100 |
| commit | bd45ac0c5daae35e7c71138172e63df5cf644cf6 (patch) | |
| tree | 5eb5a599bf6a9d7a8a34e802db932aa9e9555de4 /net/irda/ircomm/ircomm_core.c | |
| parent | 4eece4ccf997c0e6d8fdad3d842e37b16b8d705f (diff) | |
| parent | 5bdeae46be6dfe9efa44a548bd622af325f4bdb4 (diff) | |
Merge branch 'linux-2.6'
Diffstat (limited to 'net/irda/ircomm/ircomm_core.c')
| -rw-r--r-- | net/irda/ircomm/ircomm_core.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c index 2d63fa8e1556..b825399fc160 100644 --- a/net/irda/ircomm/ircomm_core.c +++ b/net/irda/ircomm/ircomm_core.c @@ -363,6 +363,18 @@ void ircomm_process_data(struct ircomm_cb *self, struct sk_buff *skb) clen = skb->data[0]; /* + * Input validation check: a stir4200/mcp2150 combinations sometimes + * results in frames with clen > remaining packet size. These are + * illegal; if we throw away just this frame then it seems to carry on + * fine + */ + if (unlikely(skb->len < (clen + 1))) { + IRDA_DEBUG(2, "%s() throwing away illegal frame\n", + __FUNCTION__ ); + return; + } + + /* * If there are any data hiding in the control channel, we must * deliver it first. The side effect is that the control channel * will be removed from the skb |